Send it to their Gmail account. Tell them to download the attached file, which w... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		danielweber on Nov 6, 2014 \| parent \| context \| favorite \| on: Reflected File Download: A New Web Attack Vector Send it to their Gmail account. Tell them to download the attached file, which will "come from google.com."

geofft on Nov 6, 2014 [–]

It comes from https://mail-attachment.googleusercontent.com, so it's not super useful for the sort of attacks that this approach would be used for.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact